@deepseek-ai/dsh-auth-tunnel

Usage

Prerequisites

• The dsh CLI and pnpm are available on PATH; the plugin command creates the Web profile when it is missing.
• cloudflared available on PATH, or an absolute executable configured for the plugin.
• A long, random shared password stored as a DSH credential.

Install

Install the bundle from Git:

dsh plugin --profile web add github:ai-eks/dsh-auth-tunnel

Git installs build the checked-out sources through prepare. pnpm 10 and later may first ask you to allow that build in the profile's pnpm-workspace.yaml; follow the path and exact package key printed by dsh and then rerun the command.

For a local checkout, build it before adding the path:

cd /path/to/dsh-auth-tunnel
pnpm install
dsh plugin --profile web add .

The bundle inserts and enables the auth-tunnel row in quick mode and replaces the Host-native directory picker with the in-app browser picker. No deepseek-harness source edit or extra profile row is required.

Quick mode

Quick mode is the default. Store the shared password in $DSH_HOME/.credentials.yaml ($DSH_HOME defaults to ~/.dsh):

DSH_WEB_PASSWORD: 'replace-with-a-long-random-password'

Start the Web profile:

dsh web

After the tunnel is ready, the terminal prints:

cloudflare tunnel: https://.trycloudflare.com

Open that URL and enter DSH_WEB_PASSWORD on the login page. Share the URL, not the password. The active row also appears in Web Settings → Plugins.

Named tunnel mode

Use token mode when the public hostname must remain stable. Create a named Cloudflare Tunnel, bind a hostname such as gui.example.com, and point its dashboard ingress at a fixed loopback gate such as http://127.0.0.1:7677.

Store both credentials in $DSH_HOME/.credentials.yaml:

DSH_WEB_PASSWORD: 'replace-with-a-long-random-password'
DSH_TUNNEL_TOKEN: 'eyJhIjo...'

Override the bundle row in $DSH_HOME/profiles/web/cordis.patch.yml:

- id: auth-tunnel
  disabled: false
  config:
    mode: token
    tokenRef: DSH_TUNNEL_TOKEN
    publicHostname: gui.example.com
    gatePort: 7677

publicHostname is only the DNS hostname: do not include https://, a port, or a path. The profile patch is applied after bundle layers and is watched by the launcher, so saving it reloads the row.

Configuration reference

Key	Type	Default	Effect
passwordRef	string (credential-ref)	DSH_WEB_PASSWORD	Credential reference resolving to the shared access password; unconfigured fails the boot.
sessionTtlHours	number ≥ 0.01	720	Cookie lifetime in hours (30 days).
mode	quick | token	quick	Ephemeral quick tunnel or named token tunnel.
tokenRef	string (credential-ref)	—	Tunnel Token reference; token mode only.
publicHostname	DNS hostname	—	Named-tunnel hostname without scheme, port, or path; token mode only.
gatePort	integer 0…65535	0	Loopback gate port; token mode requires a fixed non-zero value.
executable	string	cloudflared	cloudflared PATH name or absolute path.
startupTimeoutMs	integer ≥ 1	15000	How long activation waits for tunnel readiness.

Configuration reference

Key	Type	Default	Effect
passwordRef	string (credential-ref)	DSH_WEB_PASSWORD	Credential reference resolving to the shared access password; unconfigured fails the boot.
sessionTtlHours	number ≥ 0.01	720	Cookie lifetime in hours (30 days).
mode	quick | token	quick	Ephemeral quick tunnel or named token tunnel.
tokenRef	string (credential-ref)	—	Tunnel Token reference; token mode only.
publicHostname	DNS hostname	—	Named-tunnel hostname without scheme, port, or path; token mode only.
gatePort	integer 0…65535	0	Loopback gate port; token mode requires a fixed non-zero value.
executable	string	cloudflared	cloudflared PATH name or absolute path.
startupTimeoutMs	integer ≥ 1	15000	How long activation waits for tunnel readiness.